Re: Non-English spam

2014-09-28 Thread Matus UHLAR - fantomas
On Thu, 25 Sep 2014 13:13:07 -0400, dar...@chaosreigns.com wrote: To enable TextCat to flag everything that's not English, in local.pre I have: loadplugin Mail::SpamAssassin::Plugin::TextCat And in local.cf I have: ok_languages en On 27.09.14 22:36, Ian Zimmerman wrote: I have done thi

Re: Non-English spam

2014-09-27 Thread Ian Zimmerman
On Thu, 25 Sep 2014 13:13:07 -0400, dar...@chaosreigns.com wrote: > To enable TextCat to flag everything that's not English, in local.pre > I have: > loadplugin Mail::SpamAssassin::Plugin::TextCat > And in local.cf I have: > ok_languages en I have done this too, but I live in an English spea

Non-English spam

2014-09-25 Thread darxus
erything that's not English, in local.pre I have: loadplugin Mail::SpamAssassin::Plugin::TextCat And in local.cf I have: ok_languages en This post was originally going to be asking if anybody wanted to collaborate on some non-English spam rules. I guess I'll re-consider that after October.

Re: over-representing non-English spam?

2009-05-20 Thread Karsten Bräckelmann
On Wed, 2009-05-20 at 19:59 +0200, Mark Martinec wrote: > Karsten wrote: > > That's trivial to do with pure HTML, too, no need for funky tricks some > > MUAs might not understand or render. Oh, and it actually is even > > trivial to do with the MIME structure and a spammy text/plain payload. > >

Re: over-representing non-English spam?

2009-05-20 Thread Mark Martinec
Karsten wrote: > On Wed, 2009-05-20 at 13:52 +0100, Justin Mason wrote: > > there is another catch, too, for HTML messages -- it's trivial with > > CSS or javascript > > That's trivial to do with pure HTML, too, no need for funky tricks some > MUAs might not understand or render. Oh, and it actual

Re: over-representing non-English spam?

2009-05-20 Thread Karsten Bräckelmann
On Wed, 2009-05-20 at 13:52 +0100, Justin Mason wrote: > there is another catch, too, for HTML messages -- it's trivial with > CSS or javascript That's trivial to do with pure HTML, too, no need for funky tricks some MUAs might not understand or render. Oh, and it actually is even trivial to do w

Re: over-representing non-English spam?

2009-05-20 Thread Karsten Bräckelmann
On Wed, 2009-05-20 at 13:04 -0400, Charles Gregory wrote: > On Wed, 20 May 2009, Karsten Bräckelmann wrote: > > The ok_locales setting defaults to all, effectively disabling all > > CHARSET_FARAWAY rules. It is intended to be set voluntarily to charsets > > you cannot even decipher, let alone read.

Re: over-representing non-English spam?

2009-05-20 Thread Charles Gregory
On Wed, 20 May 2009, Karsten Bräckelmann wrote: The ok_locales setting defaults to all, effectively disabling all CHARSET_FARAWAY rules. It is intended to be set voluntarily to charsets you cannot even decipher, let alone read. Now that I think about it, I would be much happier with a setting n

Re: over-representing non-English spam?

2009-05-20 Thread Karsten Bräckelmann
On Wed, 2009-05-20 at 12:58 +0200, Jonas Eckerman wrote: > Karsten Bräckelmann wrote: > > > This is not about OpenProtect or their decisions. Actually, there are > > more than this one sa-update mirror for the SARE rules. > > I think you missed my point. The OpenProtect channel adds a bunch of >

Re: over-representing non-English spam?

2009-05-20 Thread Justin Mason
there is another catch, too, for HTML messages -- it's trivial with CSS or javascript to "pad" a HTML page with an initial 500KB of innocuous content, then "overwrite" that padding with a later chunk of HTML loaded from later in the source. --j. On Wed, May 20, 2009 at 13:23, Mark Martinec wrote

Re: over-representing non-English spam?

2009-05-20 Thread Mark Martinec
Jason, > I wonder: what would be the real downside to "spamc -s 50" actually > sending the first 50 bytes instead of sending nothing for email > > 500K? I realise there would be at least one missing MIME end-boundary, > but it would still pass all the headers and some of the content... Ye

Re: over-representing non-English spam?

2009-05-20 Thread Jonas Eckerman
Karsten Bräckelmann wrote: This is not about OpenProtect or their decisions. Actually, there are more than this one sa-update mirror for the SARE rules. I think you missed my point. The OpenProtect channel adds a bunch of SARE rulesets in a single channel. This means that when you use that c

Re: over-representing non-English spam?

2009-05-19 Thread Jason Haar
On 05/20/2009 12:37 PM, Karsten Bräckelmann wrote: > > The ok_locales setting defaults to all, effectively disabling all > CHARSET_FARAWAY rules. It is intended to be set voluntarily to charsets > you cannot even decipher, let alone read. > > Doh! I run a separate instance of SA for my own mail

Re: over-representing non-English spam?

2009-05-19 Thread Karsten Bräckelmann
While I agree with all the good info (snipped) above, and pretty much said exactly that myself... > Using the OpenProtect channel means that you (or your admin) have > decided to trust OpenProtect to decide for you wich rules to add to your > ruleset. If you find that you don't agree with OpenPr

Re: over-representing non-English spam?

2009-05-19 Thread Karsten Bräckelmann
On Wed, 2009-05-20 at 12:01 +1200, Jason Haar wrote: > Hi there > > I just got a very large Chinese spam (>4M) - I seem to get several of > these a month. Anyway, while I was fiddling with it I saw the score SA > gave it when it could actually swallow the whole thing (see below). > > As you can s

Re: over-representing non-English spam?

2009-05-19 Thread Jonas Eckerman
Jason Haar wrote: As you can see, MIME_CHARSET_FARAWAY, CHARSET_FARAWAY_HEADER, and SARE_SUB_ENC_GB2312 (from openprotect rules) all triggered - total of 8.0 points. Sounds good - but of course that's very bad! Doesn't that mean an actual legitimate Chinese email would *default to a score of 8.0

over-representing non-English spam?

2009-05-19 Thread Jason Haar
Hi there I just got a very large Chinese spam (>4M) - I seem to get several of these a month. Anyway, while I was fiddling with it I saw the score SA gave it when it could actually swallow the whole thing (see below). As you can see, MIME_CHARSET_FARAWAY, CHARSET_FARAWAY_HEADER, and SARE_SUB_ENC_